CVE-2026-89604: Linux Kernel efivarfs DOS Vulnerability

CVE-2026-89604 Overview

CVE-2026-89604 is a resource exhaustion vulnerability in the Linux kernel's efivarfs filesystem. Unprivileged users can invoke statfs() on the efivarfs mount point, which triggers calls to the UEFI QueryVariableInfo() runtime service. On x86 systems where the variable store is backed by System Management Mode (SMM), each call requires a rendezvous of all CPUs, making the operation disproportionately costly. Repeated invocations can flood the system and degrade performance. The upstream fix rate-limits QueryVariableInfo() calls to twice per second and returns cached values for elided requests.

Critical Impact
Unprivileged local users can trigger CPU-wide SMM rendezvous events by repeatedly calling statfs() on efivarfs, resulting in system-wide performance degradation on affected x86 Linux systems.

Affected Products

Linux kernel (mainline efivarfs implementation prior to the patched commits)
Stable kernel branches receiving backports referenced in the fix commits
x86 systems using SMM-backed UEFI variable storage are most affected

Discovery Timeline

2026-09-11 - CVE-2026-89604 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89604

Vulnerability Analysis

The efivarfs pseudo-filesystem exposes UEFI variables to userspace under /sys/firmware/efi/efivars. Its statfs() handler queried firmware for storage information on every call by invoking the UEFI QueryVariableInfo() runtime service. Because statfs() is callable by any unprivileged user with access to the mount point, an attacker could issue a tight loop of statfs() syscalls to force repeated firmware transitions.

On x86 platforms, UEFI runtime services frequently execute in SMM. Entering SMM requires a rendezvous where every logical CPU is interrupted and enters System Management Mode. This synchronizes all cores and stalls unrelated workloads for the duration of each firmware call. A sustained flood of QueryVariableInfo() invocations therefore acts as an amplification vector, converting cheap userspace syscalls into expensive system-wide stalls.

Root Cause

The root cause is missing rate limiting in the efivarfsstatfs() implementation. The handler unconditionally called into firmware without caching results or throttling frequency. This design assumed low call volume and did not account for adversarial repeated invocation by unprivileged callers.

Attack Vector

Exploitation requires local access and the ability to issue syscalls against the efivarfs mount point. An attacker executes statfs() or statvfs() in a loop against a path under efivarfs. Each call triggers QueryVariableInfo() and, on x86 SMM-backed systems, a full-CPU rendezvous. The result is a denial-of-service condition affecting all workloads on the host. See the kernel fix commit 3cd611c9 for the upstream remediation.

Detection Methods for CVE-2026-89604

Indicators of Compromise

Sustained high rate of statfs() or statvfs() syscalls targeting paths under /sys/firmware/efi/efivars from unprivileged processes
Elevated SMI (System Management Interrupt) counters observable via /proc/interrupts or hardware performance counters
Unexplained periodic multi-core stalls or scheduling latency spikes correlated with firmware activity

Detection Strategies

Monitor syscall telemetry for anomalous statfs() frequency against efivarfs mount points using eBPF or auditd rules
Track SMI rate on x86 hosts and alert on sustained increases beyond baseline
Correlate userspace process activity with kernel-mode CPU spikes affecting multiple cores simultaneously

Monitoring Recommendations

Enable auditd rules on /sys/firmware/efi/efivars to log access patterns from non-root users
Baseline SMI counts per host and alert on statistical deviations
Track kernel version inventory to identify hosts running unpatched efivarfs code

How to Mitigate CVE-2026-89604

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the commits below to rate-limit QueryVariableInfo() calls
Restrict access to the efivarfs mount point to trusted administrative accounts where operationally feasible
Inventory x86 systems with SMM-backed UEFI variable stores, which face the greatest impact

Patch Information

The fix rate-limits QueryVariableInfo() invocations to twice per second and returns the most recently cached value for elided calls. Patched commits include 0dbc2e94, 3cd611c9, 8953bdd1, 92895a14, 97d71ebe, and b2326338. Update to a distribution kernel that incorporates these backports.

Workarounds

Unmount efivarfs on systems that do not require runtime UEFI variable access
Tighten mount options or filesystem permissions to prevent unprivileged access to the mount point
Deploy cgroup or seccomp policies that restrict statfs() syscall rates for untrusted workloads

bash

# Temporarily unmount efivarfs where UEFI variable access is not required
umount /sys/firmware/efi/efivars

# Or restrict access via mount permissions (persist via fstab as needed)
mount -o remount,mode=0700 /sys/firmware/efi/efivars